FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Gentoo > Gentoo User

 
 
LinkBack Thread Tools
 
Old 05-11-2010, 05:33 AM
Mick
 
Default I've been hacked.

On Tuesday 11 May 2010 05:58:28 Grant wrote:
> I nmap'ed one of my remote Gentoo servers today and besides the
> expected open ports were these:
>
> 1080/tcp open socks
> 3128/tcp open squid-http
> 8080/tcp open http-proxy
>
> I'm not running any sort of proxy software that I know of and I should
> be the only person whatsoever with access to the machine. 'netstat
> -l' doesn't show any info on those ports at all so I suppose it's been
> hacked as well? I installed and ran 'rkhunter --check' (what happened
> to the chrootkit ebuild?) but it doesn't seem to be much use since I
> hadn't established a "file of stored file properties".
>
> What do you guys think is going on? What should I do from here?

What does lsof (I'd reinstall it afresh) show with regards to strange users?
What users the above services run under. If indeed they are not legitimate
and you confirm that they are not being run as packages that you installed,
then I'm afraid the only sane option is to reinstall.

--
Regards,
Mick
 
Old 05-11-2010, 06:54 AM
Grant
 
Default I've been hacked.

>> I nmap'ed one of my remote Gentoo servers today and besides the
>> expected open ports were these:
>>
>> 1080/tcp open *socks
>> 3128/tcp open *squid-http
>> 8080/tcp open *http-proxy
>>
>> I'm not running any sort of proxy software that I know of and I should
>> be the only person whatsoever with access to the machine. *'netstat
>> -l' doesn't show any info on those ports at all so I suppose it's been
>> hacked as well? *I installed and ran 'rkhunter --check' (what happened
>> to the chrootkit ebuild?) but it doesn't seem to be much use since I
>> hadn't established a "file of stored file properties".
>>
>> What do you guys think is going on? *What should I do from here?
>
> What does lsof (I'd reinstall it afresh) show with regards to strange users?
> What users the above services run under. *If indeed they are not legitimate
> and you confirm that they are not being run as packages that you installed,
> then I'm afraid the only sane option is to reinstall.

Wow. I'm actually seeing the same thing from other domains I nmap.
Could my ISP have some kind of a weird environment set up that makes
it look like there are ports such as these open on remote systems?
Right now I'm on some kind of a shared connection where everyone has
their own modem or router or whatever it is, but I think everyone's IP
is the same.

- Grant
 
Old 05-11-2010, 07:39 AM
Norman Rieß
 
Default I've been hacked.

Am 05/11/10 08:54, schrieb Grant:

I nmap'ed one of my remote Gentoo servers today and besides the
expected open ports were these:

1080/tcp open socks
3128/tcp open squid-http
8080/tcp open http-proxy

I'm not running any sort of proxy software that I know of and I should
be the only person whatsoever with access to the machine. 'netstat
-l' doesn't show any info on those ports at all so I suppose it's been
hacked as well? I installed and ran 'rkhunter --check' (what happened
to the chrootkit ebuild?) but it doesn't seem to be much use since I
hadn't established a "file of stored file properties".

What do you guys think is going on? What should I do from here?


What does lsof (I'd reinstall it afresh) show with regards to strange users?
What users the above services run under. If indeed they are not legitimate
and you confirm that they are not being run as packages that you installed,
then I'm afraid the only sane option is to reinstall.


Wow. I'm actually seeing the same thing from other domains I nmap.
Could my ISP have some kind of a weird environment set up that makes
it look like there are ports such as these open on remote systems?
Right now I'm on some kind of a shared connection where everyone has
their own modem or router or whatever it is, but I think everyone's IP
is the same.

- Grant



Hello,

looks like, your ISP has a Transparent Proxy Setup running.

Regards,
Norman
 
Old 05-11-2010, 02:09 PM
Mick
 
Default I've been hacked.

On 11 May 2010 08:39, Norman Rieß <norman@smash-net.org> wrote:
> Am 05/11/10 08:54, schrieb Grant:
>>>>
>>>> I nmap'ed one of my remote Gentoo servers today and besides the
>>>> expected open ports were these:
>>>>
>>>> 1080/tcp open *socks
>>>> 3128/tcp open *squid-http
>>>> 8080/tcp open *http-proxy
>>>>
>>>> I'm not running any sort of proxy software that I know of and I should
>>>> be the only person whatsoever with access to the machine. *'netstat
>>>> -l' doesn't show any info on those ports at all so I suppose it's been
>>>> hacked as well? *I installed and ran 'rkhunter --check' (what happened
>>>> to the chrootkit ebuild?) but it doesn't seem to be much use since I
>>>> hadn't established a "file of stored file properties".
>>>>
>>>> What do you guys think is going on? *What should I do from here?
>>>>
>>>
>>> What does lsof (I'd reinstall it afresh) show with regards to strange
>>> users?
>>> What users the above services run under. *If indeed they are not
>>> legitimate
>>> and you confirm that they are not being run as packages that you
>>> installed,
>>> then I'm afraid the only sane option is to reinstall.
>>>
>>
>> Wow. *I'm actually seeing the same thing from other domains I nmap.
>> Could my ISP have some kind of a weird environment set up that makes
>> it look like there are ports such as these open on remote systems?
>> Right now I'm on some kind of a shared connection where everyone has
>> their own modem or router or whatever it is, but I think everyone's IP
>> is the same.
>>
>> - Grant
>>
>>
>
> Hello,
>
> looks like, your ISP has a Transparent Proxy Setup running.

Ports being shown as open does not mean that your machine is
listening, more like the firewall has some holes in it. If the
firewall is not configured/running on your server itself, then you may
be alright. Can you actually connect to your server using those
ports?

Have you tried telnet, or nc -v -z <your_host_name> <port> to see if
they are open?

If the above as well as lsof show nothing, can you nmap your machine
from within the LAN that it is hosted in?

HTH.
--
Regards,
Mick
 
Old 05-11-2010, 02:29 PM
Paul Hartman
 
Default I've been hacked.

On Tue, May 11, 2010 at 1:54 AM, Grant <emailgrant@gmail.com> wrote:
>>> I nmap'ed one of my remote Gentoo servers today and besides the
>>> expected open ports were these:
>>>
>>> 1080/tcp open socks
>>> 3128/tcp open squid-http
>>> 8080/tcp open http-proxy
>>>
>>> I'm not running any sort of proxy software that I know of and I should
>>> be the only person whatsoever with access to the machine. 'netstat
>>> -l' doesn't show any info on those ports at all so I suppose it's been
>>> hacked as well? I installed and ran 'rkhunter --check' (what happened
>>> to the chrootkit ebuild?) but it doesn't seem to be much use since I
>>> hadn't established a "file of stored file properties".
>>>
>>> What do you guys think is going on? What should I do from here?
>>
>> What does lsof (I'd reinstall it afresh) show with regards to strange users?
>> What users the above services run under. If indeed they are not legitimate
>> and you confirm that they are not being run as packages that you installed,
>> then I'm afraid the only sane option is to reinstall.
>
> Wow. I'm actually seeing the same thing from other domains I nmap.
> Could my ISP have some kind of a weird environment set up that makes
> it look like there are ports such as these open on remote systems?
> Right now I'm on some kind of a shared connection where everyone has
> their own modem or router or whatever it is, but I think everyone's IP
> is the same.

Like Norman suggested, sounds like maybe your ISP or local IT staff
are playing man-in-the-middle.

Try running the Netalyzer (warning: java) maybe it can tell you about
it. http://netalyzr.icsi.berkeley.edu/

Otherwise, I would try to nmap your server from a different internet
connection when possible. Hopefully you won't see those ports open on
your server. Hopefully.

I think nmap is typically not recommended to be run from behind
router/NAT because the results are not necessarily true.
 
Old 05-11-2010, 07:28 PM
Grant
 
Default I've been hacked.

>>>>> I nmap'ed one of my remote Gentoo servers today and besides the
>>>>> expected open ports were these:
>>>>>
>>>>> 1080/tcp open *socks
>>>>> 3128/tcp open *squid-http
>>>>> 8080/tcp open *http-proxy
>>>>>
>>>>> I'm not running any sort of proxy software that I know of and I should
>>>>> be the only person whatsoever with access to the machine. *'netstat
>>>>> -l' doesn't show any info on those ports at all so I suppose it's been
>>>>> hacked as well? *I installed and ran 'rkhunter --check' (what happened
>>>>> to the chrootkit ebuild?) but it doesn't seem to be much use since I
>>>>> hadn't established a "file of stored file properties".
>>>>>
>>>>> What do you guys think is going on? *What should I do from here?
>>>>>
>>>>
>>>> What does lsof (I'd reinstall it afresh) show with regards to strange
>>>> users?
>>>> What users the above services run under. *If indeed they are not
>>>> legitimate
>>>> and you confirm that they are not being run as packages that you
>>>> installed,
>>>> then I'm afraid the only sane option is to reinstall.
>>>>
>>>
>>> Wow. *I'm actually seeing the same thing from other domains I nmap.
>>> Could my ISP have some kind of a weird environment set up that makes
>>> it look like there are ports such as these open on remote systems?
>>> Right now I'm on some kind of a shared connection where everyone has
>>> their own modem or router or whatever it is, but I think everyone's IP
>>> is the same.
>>>
>>> - Grant
>>>
>>>
>>
>> Hello,
>>
>> looks like, your ISP has a Transparent Proxy Setup running.

Should I be worried about that?

> Ports being shown as open does not mean that your machine is
> listening, more like the firewall has some holes in it. *If the

Really? I thought a service had to be listening for the port to be
open. So from nmap, there is no way to tell the difference between a
port that isn't blocked by a firewall and one that is listening?

> firewall is not configured/running on your server itself, then you may
> be alright. *Can you actually connect to your server using those
> ports?

If I enter the server's IP appended with one of the port numbers
listed above into a web browser, I get:

"tinyproxy 1.6.0
The page you requested was unavailable. The error code is listed
below. In addition, the HTML file which has been configured as the
page to be displayed when an error of this type was unavailable, with
the error code 14 (Bad address). Please contact your administrator.
Bad Request"

The thing is, I get the same thing from any domain I enter appended
with one of those ports.

> Have you tried telnet, or nc -v -z <your_host_name> <port> to see if
> they are open?

Can you tell me what package nc is included in?

- Grant
 
Old 05-11-2010, 07:40 PM
Paul Hartman
 
Default I've been hacked.

On Tue, May 11, 2010 at 2:28 PM, Grant <emailgrant@gmail.com> wrote:
> Can you tell me what package nc is included in?

netcat
 
Old 05-11-2010, 07:48 PM
Nikos Chantziaras
 
Default I've been hacked.

On 05/11/2010 10:28 PM, Grant wrote:

I nmap'ed one of my remote Gentoo servers today and besides the
expected open ports were these:

1080/tcp open socks
3128/tcp open squid-http
8080/tcp open http-proxy

I'm not running any sort of proxy software that I know of and I should
be the only person whatsoever with access to the machine. 'netstat
-l' doesn't show any info on those ports at all so I suppose it's been
hacked as well? I installed and ran 'rkhunter --check' (what happened
to the chrootkit ebuild?) but it doesn't seem to be much use since I
hadn't established a "file of stored file properties".

What do you guys think is going on? What should I do from here?



What does lsof (I'd reinstall it afresh) show with regards to strange
users?
What users the above services run under. If indeed they are not
legitimate
and you confirm that they are not being run as packages that you
installed,
then I'm afraid the only sane option is to reinstall.



Wow. I'm actually seeing the same thing from other domains I nmap.
Could my ISP have some kind of a weird environment set up that makes
it look like there are ports such as these open on remote systems?
Right now I'm on some kind of a shared connection where everyone has
their own modem or router or whatever it is, but I think everyone's IP
is the same.

- Grant




Hello,

looks like, your ISP has a Transparent Proxy Setup running.


Should I be worried about that?


"Your ISP" in this case means the ISP of your home, not the server's.
That means you will see these ports apparently open for every
IP/hostname you try.
 
Old 05-12-2010, 11:40 AM
Adam
 
Default I've been hacked.

>>> looks like, your ISP has a Transparent Proxy Setup running.
>
> Should I be worried about that?

No.

>> Ports being shown as open does not mean that your machine is
>> listening, more like the firewall has some holes in it. If the
>
> Really? I thought a service had to be listening for the port to be
> open. So from nmap, there is no way to tell the difference between a
> port that isn't blocked by a firewall and one that is listening?

You're right - a TCP service does need to be listening for the port to
be shown as open. However, a device in the path like a proxy may answer
on behalf of the actual destination. ISPs can do this so that you will
use their proxy without having to configure a proxy in your browser.

Firewalls can block ports in two ways;
1.Reject the packet, that is, respond to the SYN with an RST packet
(which is also what the operating system does if the port is closed) and
not forward the packet to the destination
2. Drop the packet, that is, dont respond to the packet or forward it on
to the destination.
 

Thread Tools




All times are GMT. The time now is 02:11 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright ©2007 - 2008, www.linux-archive.org